diff --git a/.config/setup/02-install-debian-testing.sh b/.config/setup/02-install-debian-testing.sh
index 7cf2c21..0b55046 100755
--- a/.config/setup/02-install-debian-testing.sh
+++ b/.config/setup/02-install-debian-testing.sh
@@ -3,8 +3,8 @@
 set -euo pipefail
 IFS=$'\n\t'
 
-sudo cp "$(systemd-path user-configuration)"/setup/sources.list.d/debian.sources /etc/apt/sources.list.d/
-sudo rm /etc/apt/sources.list
+run0 cp "$(systemd-path user-configuration)"/setup/sources.list.d/debian.sources /etc/apt/sources.list.d/
+run0 rm /etc/apt/sources.list
 
-sudo apt update
-sudo apt --yes full-upgrade
+run0 apt update
+run0 apt --yes full-upgrade
diff --git a/.config/setup/04-install-deb-packages.sh b/.config/setup/04-install-deb-packages.sh
index c96ba44..23ef30f 100755
--- a/.config/setup/04-install-deb-packages.sh
+++ b/.config/setup/04-install-deb-packages.sh
@@ -105,5 +105,5 @@ META_PKGS=(
     # keep-sorted end
 )
 
-sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes "${DEB_PKGS[@]}"
-sudo DEBIAN_FRONTEND=noninteractive apt-get install --install-recommends --yes "${META_PKGS[@]}"
+run0 --setenv=DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes "${DEB_PKGS[@]}"
+run0 --setenv=DEBIAN_FRONTEND=noninteractive apt-get install --install-recommends --yes "${META_PKGS[@]}"
diff --git a/.config/setup/12-setup-packages.sh b/.config/setup/12-setup-packages.sh
index 6c3ad50..ded26af 100755
--- a/.config/setup/12-setup-packages.sh
+++ b/.config/setup/12-setup-packages.sh
@@ -19,6 +19,6 @@ mkdir --parents ~/Pictures/screenshots
 
 pre-commit install
 
-sudo usermod --append --groups dialout "${USER}"
+run0 usermod --append --groups dialout "${USER}"
 
-echo 'kernel.perf_event_paranoid=1' | sudo tee '/etc/sysctl.d/51-enable-perf-events.conf'
+echo 'kernel.perf_event_paranoid=1' | run0 tee '/etc/sysctl.d/51-enable-perf-events.conf'
diff --git a/.config/setup/16-install-tor.sh b/.config/setup/16-install-tor.sh
index 44bf3f5..def32bf 100755
--- a/.config/setup/16-install-tor.sh
+++ b/.config/setup/16-install-tor.sh
@@ -3,12 +3,12 @@
 set -euo pipefail
 IFS=$'\n\t'
 
-sudo cp "$(systemd-path user-configuration)"/setup/sources.list.d/tor.sources /etc/apt/sources.list.d/
-sudo chmod 644 /etc/apt/sources.list.d/tor.sources
+run0 cp "$(systemd-path user-configuration)"/setup/sources.list.d/tor.sources /etc/apt/sources.list.d/
+run0 chmod 644 /etc/apt/sources.list.d/tor.sources
 
 outfile=/usr/share/keyrings/deb.torproject.org-keyring.pgp
-curl --silent https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | sudo tee "${outfile}" >/dev/null
-sudo chmod 644 "${outfile}"
+curl --silent https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | run0 tee "${outfile}" >/dev/null
+run0 chmod 644 "${outfile}"
 
 TOR_PKGS=(
     # keep-sorted start
@@ -18,5 +18,5 @@ TOR_PKGS=(
     # keep-sorted end
 )
 
-sudo apt update
-sudo apt install --no-install-recommends --yes "${TOR_PKGS[@]}"
+run0 apt update
+run0 apt install --no-install-recommends --yes "${TOR_PKGS[@]}"
diff --git a/.config/setup/31-initialize-backup-repository.sh b/.config/setup/31-initialize-backup-repository.sh
index fe2c0cf..81441d6 100755
--- a/.config/setup/31-initialize-backup-repository.sh
+++ b/.config/setup/31-initialize-backup-repository.sh
@@ -3,8 +3,8 @@
 set -euo pipefail
 IFS=$'\n\t'
 
-sudo mkdir --parents "${BORG_REPO}"
-sudo chown "${USER}":"${USER}" "${BORG_REPO}"
-sudo chmod 700 "${BORG_REPO}"
+run0 mkdir --parents "${BORG_REPO}"
+run0 chown "${USER}":"${USER}" "${BORG_REPO}"
+run0 chmod 700 "${BORG_REPO}"
 
 borg init --encryption=repokey
diff --git a/.local/bin/no-ipv6 b/.local/bin/no-ipv6
index 3ad8edb..18495df 100755
--- a/.local/bin/no-ipv6
+++ b/.local/bin/no-ipv6
@@ -3,6 +3,6 @@
 set -euo pipefail
 IFS=$'\n\t'
 
-sudo sysctl net.ipv6.conf.all.disable_ipv6=1
+run0 sysctl net.ipv6.conf.all.disable_ipv6=1
 "$@"
-sudo sysctl net.ipv6.conf.all.disable_ipv6=0
+run0 sysctl net.ipv6.conf.all.disable_ipv6=0
diff --git a/.local/bin/upgrade b/.local/bin/upgrade
index b209d96..d15adca 100755
--- a/.local/bin/upgrade
+++ b/.local/bin/upgrade
@@ -4,11 +4,9 @@ set -euo pipefail
 IFS=$'\n\t'
 
 apt_update() {
-    sudo --reset-timestamp
-    sudo apt update --audit && apt list --upgradable
-    sudo apt full-upgrade
-    sudo apt autoremove
-    sudo --reset-timestamp
+    run0 apt update --audit && apt list --upgradable
+    run0 apt full-upgrade
+    run0 apt autoremove
 }
 
 cargo_update() {